php4 4:4.3.10-10ubuntu4.5 source package in Ubuntu

Changelog

php4 (4:4.3.10-10ubuntu4.5) hoary-security; urgency=low

  * SECURITY UPDATE: Multiple vulnerabilities.
  * debian/patches/CVE-2006-0996.patch:
    - XSS in phpinfo() [CVE-2006-0996]
    - http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/info.c?r1=1.260&r2=1.261
      (that's the PHP5 version, ported to 4.3)
  * debian/patches/CVE-2006-1490.patch:
    - Memory disclosure in html_entity_decode() [CVE-2006-1490]
    - http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/html.c?r1=1.112&r2=1.113
  * debian/patches/CVE-2006-1494.patch:
    - Bypassing open_basedir restrictions with tempnam()
      [CVE-2006-1494, CVE-2006-2660]
    - http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/file.c?r1=1.429&r2=1.430
  * debian/patches/CVE-2006-1608.patch:
    - Bypassing open_basedir restrictions with copy() via a source argument
      containing a compress.zlib:// URI [CVE-2006-1608]
    - http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/file.c?r1=1.279.2.70&r2=1.279.2.71
  * debian/patches/CVE-2006-1990.patch:
    - Integer overflow in wordwrap function (usually not triggerable from
      outside). [CVE-2006-1990]
    - http://cvs.php.net/viewcvs.cgi/php-src/ext/standard/string.c?r1=1.333.2.52.2.3&r2=1.333.2.52.2.4
    - Zend/zend_alloc.c: Fix variable declaration to work on 64-bit systems to
      plug this vulnerability on amd64/ia64, too. (not yet fixed upstream)
  * debian/patches/CVE-2006-2563.patch:
    - Bypassing safe mode/open_basedir restrictions with curl module
      [CVE-2006-2563]
    - Patch taken from Mandriva, not fixed upstream.
  * debian/patches/CVE-2006-3011.patch:
    - Bypassing safe mode/open_basedir restrictions with error_log() with
      'php://' or other schema in the third argument. [CVE-2006-3011]
    - http://cvs.php.net/viewvc.cgi/php-src/ext/standard/basic_functions.c?r1=1.543.2.51.2.9&r2=1.543.2.51.2.10
  * debian/patches/CVE-2006-3017.patch:
    - Fix zend_hash_del() (previously could delete the wrong element, which
      prevented a variable from being unset even when the PHP unset function
      was called, which might cause the variable's value to be used in
      security-relevant operations). [CVE-2006-3017]
    - http://cvs.php.net/viewcvs.cgi/Zend/zend_hash.c?r1=1.87.4.8.2.1&r2=1.87.4.8.2.3
  * debian/patches/CVE-2006-3018.patch:
    - Heap corruption in session extension. [CVE-2006-3018]
    - http://cvs.php.net/viewcvs.cgi/php-src/ext/session/mod_files.c?r1=1.102&r2=1.103

 -- Martin Pitt <email address hidden>   Wed, 19 Jul 2006 09:13:45 +0000